CVE-2026-53289 Overview
CVE-2026-53289 is a NULL pointer dereference vulnerability in the Linux kernel's Intel Ethernet (ice) driver. The flaw resides in the ice_reset_all_vfs() function, which ignores the return value of ice_vf_rebuild_vsi(). When a Virtual Station Interface (VSI) rebuild fails, such as during a Non-Volatile Memory (NVM) firmware update via nvmupdate64e, the VSI teardown leaves txq_map and rxq_map as NULL. The subsequent unconditional call to ice_vf_post_vsi_rebuild() triggers a NULL pointer dereference in ice_ena_vf_q_mappings() when it accesses vsi->txq_map[0], crashing the kernel.
Critical Impact
A failed VSI rebuild on hosts using Intel E800-series NICs with SR-IOV virtual functions causes a kernel panic, resulting in denial of service on affected virtualization hosts.
Affected Products
- Linux kernel versions containing the ice driver prior to the fix commits
- Systems using Intel E800-series Ethernet controllers with SR-IOV enabled
- Virtualization hosts performing NVM firmware updates via nvmupdate64e on ice-managed NICs
Discovery Timeline
- 2026-06-26 - CVE-2026-53289 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-53289
Vulnerability Analysis
The vulnerability is a NULL pointer dereference [CWE-476] in the SR-IOV reset path of the Intel ice driver. The function ice_reset_all_vfs() calls ice_vf_rebuild_vsi() to rebuild each virtual function's VSI but does not check the return value. When ice_vsi_rebuild() fails on its internal error path, it tears down the VSI and leaves the txq_map and rxq_map pointers set to NULL, while the ice_vsi structure itself remains allocated.
Execution then proceeds unconditionally to ice_vf_post_vsi_rebuild(), which invokes ice_ena_vf_q_mappings(). This function dereferences vsi->txq_map[0] at offset 0x4b8 of the ice_vsi structure, triggering a page fault and kernel oops. The single-VF path in ice_reset_vf() already handles this correctly by checking ice_vf_reconfig_vsi()'s return, but the multi-VF path did not follow the same pattern.
Root Cause
The root cause is missing return-value validation in ice_reset_all_vfs(). VSI rebuild failures commonly occur during NVM firmware updates because the firmware enters a transitional state while processing an Embedded Management Processor (EMP) reset. During this window, Admin Queue commands such as ice_add_vsi and ice_cfg_vsi_lan fail, leaving the VSI partially initialized.
Attack Vector
The issue is triggered locally through legitimate administrative operations, most notably NVM firmware updates on systems with SR-IOV virtual functions. An administrator or automated management workflow running nvmupdate64e while VFs are attached can induce the failure condition. The vulnerability affects host availability and is not a remote code execution vector. See the Kernel Git Commit for the fix.
Detection Methods for CVE-2026-53289
Indicators of Compromise
- Kernel oops or panic traces referencing ice_ena_vf_q_mappings, ice_sriov_post_vsi_rebuild, or ice_reset_all_vfs in dmesg or crash dumps
- Page fault exceptions with a NULL RDX register during ice_service_task execution on the workqueue
- System crashes correlated with nvmupdate64e activity on hosts running the ice driver with active VFs
Detection Strategies
- Monitor /var/log/messages and journalctl -k for ice driver errors reporting VSI rebuild failures or Admin Queue command timeouts
- Correlate host crash events with concurrent firmware update or PCI reset operations against Intel E800-series NICs
- Track kernel version inventory to identify hosts running vulnerable ice driver builds prior to the stable fix
Monitoring Recommendations
- Collect kernel crash dumps via kdump on virtualization hosts to preserve stack traces for post-incident analysis
- Alert on repeated VF reset failures reported by ip link show or ethtool statistics counters
- Ingest kernel logs into a centralized log platform to detect the ice_ena_vf_q_mappings+0x79 faulting RIP pattern across the fleet
How to Mitigate CVE-2026-53289
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected hosts
- Defer NVM firmware updates via nvmupdate64e on unpatched hosts until VFs are detached or the host has no active SR-IOV workloads
- Inventory all hosts running the ice driver with SR-IOV enabled and prioritize patching for virtualization and NFV infrastructure
Patch Information
The fix modifies ice_reset_all_vfs() to check the return value of ice_vf_rebuild_vsi() and skip both ice_vf_post_vsi_rebuild() and ice_eswitch_attach_vf() when the rebuild fails. The affected VF is left safely disabled with ICE_VF_STATE_INIT unset and VFGEN_RSTAT not marked VFACTIVE, allowing recovery via a VF-Level Reset (VFLR) triggered by a PCI reset. Patches are available in the stable kernel tree: commit 1e9185b1, commit 3ad2471e, commit 429024f3, commit 4c2ac52e, commit 54ef0248, and commit acc76b97.
Workarounds
- Detach all SR-IOV virtual functions before performing NVM firmware updates on Intel E800-series NICs
- Recover a stuck VF after a failed rebuild by triggering a PCI reset through sysfs or by unbinding and rebinding the driver
- Schedule firmware updates during maintenance windows to limit the availability impact if a rebuild failure occurs
# Recovery example: trigger a PCI reset of a VF after a failed rebuild
echo 1 > /sys/bus/pci/devices/<VF_BDF>/reset
# Or unbind and rebind the VF driver
echo <VF_BDF> > /sys/bus/pci/drivers/iavf/unbind
echo <VF_BDF> > /sys/bus/pci/drivers/iavf/bind
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
